The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read all files within the content directory (e.g., Markdown and JSON files) to automatically infer data schemas and model the CMS structure. This processing of untrusted user content creates a surface for indirect prompt injection, where malicious instructions embedded in those data files could attempt to manipulate the agent's behavior during the configuration process.
Ingestion points: Files located in the project's contentFolder (e.g., src/content/*.md, src/content/*.json).
Boundary markers: The instructions do not mandate the use of delimiters or specific safety instructions to ignore embedded commands when parsing these content files.
Capability inventory: The skill possesses capabilities to modify package.json scripts, write new TypeScript files to the qino/ directory, and execute shell commands via the package manager.
Sanitization: There are no explicit instructions for sanitizing or escaping the content read from files before it is used to generate code schemas, relying entirely on the agent's internal logic.
[COMMAND_EXECUTION]: The skill requires the execution of shell commands to install dependencies and run the qino build utility to verify the setup and generate types.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs the @qino/cms and zod packages from the npm registry. These are identified as the vendor's primary package and a standard validation library, respectively.

set-up-qino-cms